---
id: MAL-2026-17417
title: Malicious code in beautifytext (PyPI)
summary: Malicious code in beautifytext (PyPI)
severity: critical
exploited: true
vendor: beautifytext
product: beautifytext
ecosystem: pip
affected:
  - beautifytext
published: '2026-09-30'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T20:30:04.756076783Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-17417'
references:
  - url: 'https://bad-packages.kam193.eu/pypi/package/beautifytext'
  - url: 'https://pypi.org/project/beautifyText/1.0.4/'
  - url: 'https://pypi.org/project/beautifyText/1.0.7/'
  - url: 'https://pypi.org/project/beautifyText/1.0.3/'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-10-01T07:23:13.166Z'
---

## Overview

beautifytext 1.0.3 imports beautifyText/_compat.py from its __init__.py and from a setup.py install hook. That module starts a detached background process that registers the host (hostname, user, OS, working directory) with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read and write files, and posts the results back.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (488a492f2e87fa16d545c2605cb1ca4eb18c5e912a8e1645248e7ababafc10f8)
beautifyText 1.0.3 is a backdoor disguised as a text utility. On `import beautifyText`, the package spawns a detached background Python process (via a module named `_compat`) that decodes a base64-obfuscated C2 URL (https://bleodw.wisp.uno) and enters a long-poll loop against `/work/{id}`. The command channel implements three job kinds: `exec` runs arbitrary shell commands via subprocess with `shell=True`, `pull` reads arbitrary files from the installer's host, and `push` writes arbitrary files to the installer's host, with results POSTed back to `/result`. On registration, host metadata (hostname, OS/release, Python version, USER/USERNAME, current working directory) is sent to `/register`, and `/heartbeat` maintains the session. setup.py installs an `install` and `develop` cmdclass override whose `run()` calls `_post_install()`, which imports `beautifyText._compat` and triggers the same beacon during `pip install`, so the backdoor activates on install even without a subsequent import. The C2 host is stored as a base64 literal (`_HOST_B64 = aHR0cHM6Ly9ibGVvZHcud2lzcC51bm8=`) and decoded at runtime to evade static string matching. The process is detached so it survives parent-process exit.

## Source: kam193 (cba19cfc0b2bdeec177fafdffa10e730769079a14ece3bb4740bfc0ded9fef3b)
During import, the package silently spans a separate process that waits for and executes remote commands.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-07-beautifytext


Reasons (based on the campaign):


 - rat


 - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.


## Affected packages

- `beautifytext`

## Remediation

Refer to the advisory for the patched release.